scope will probably be small (<100) for now, but we can expect it to grow. I think it still needs to fit within a URL though (it gets passed through the redirect flow), so I'd expect kilobytes, not megabytes.